Exploit CVE-2010-3081

_root_ · 09-20-2010, 10:33 PM

I feel a bit confused about the dangerous exploit CVE-2010-3081.

Redhat says that 64b kernels from April 2008 may be affected, from 2.6.26-rc1 to 2.6.36-rc4. (redhat security notice)

I installed my RHEL 5.3 in Summer 2009, and the `uname -a` command returns 2.6.18-164.9.1.el5.

Does it mean my kernel is not affected (since 2.6.18 < 2.6.26) ?

and while the installation in Summer 2009 was done with the latest RHEL version available at the time, 5.3...

Bruce Hill · 09-21-2010, 12:54 AM

Issue "zgrep CONFIG_IA32_EMULATION /proc/config.gz" and if it returns:

Code:

CONFIG_IA32_EMULATION=y

you're vulnerable.

Of course, since your OS is from RedHat you might have to
search a bit for your .config ... maybe in /boot/ ?

_root_ · 09-21-2010, 01:54 AM

Thanks. The config files are in /boot as you suggested.

Code:

config-2.6.18-194.11.3.el5:CONFIG_IA32_EMULATION=y
config-2.6.18-194.11.3.el5xen:CONFIG_IA32_EMULATION=y

And, unfortunately, it seems we have a problem.

So why do we have that restriction on kernels on the RH website?

Quote:

The flaw identified by CVE-2010-3081 describes an issue in the 32/64-bit compatibility layer implementation in the Linux kernel, versions 2.6.26-rc1 to 2.6.36-rc4.

Doesn't it mean we use the 32b emulator, that may not have the flaw?

Bruce Hill · 09-22-2010, 11:13 AM

Not sure I understand your question, but I would expect RedHat to release kernels
with that vulnerability patched. And by the way ...

Welcome to LQ!

And don't take the name of root in vain!

ysg · 09-22-2010, 11:53 AM

Red Hat uses older kernels than a lot of distributions and then patches them. The kernel you're using (2.6.18) was first released in 2006 and would not be effected by this unless Red Hat patched the problem in later. Which, from reading their security notice it looks like they DID.

Quote:

Originally Posted by Red Hat

Red Hat Enterprise Linux 5

This issue affects the 64-bit versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, as they include a backport of the upstream git commit 42908c69, which introduced the compat_mc_getsockopt() function that a local, unprivileged user can use to abuse the compat_alloc_user_space() call to escalate their privileges.

So you'll need to apply the update from Red Hat to fix this. It's also mentioned on that page.

Quote:

Originally Posted by Red Hat

Solution

This issue has been fixed in Red Hat Enterprise Linux 5 and Red Hat Enterprise Linux 5.4 Extended Update Support via the Red Hat Security Advisories RHSA-2010:0704 and RHSA-2010:0705 respectively. Future updates will address this issue for Red Hat Enterprise Linux 4 and Red Hat Enterprise MRG.

_root_ · 09-22-2010, 11:34 PM

Quote:

Originally Posted by ysg

Red Hat patched the problem in later. So you'll need to apply the update from Red Hat to fix this. It's also mentioned on that page.

Thanks, it is clear now.

Quote:

Originally Posted by Bruce Hill

And don't take the name of root in vain!

Well, that's the easiest hack I ever had to do to become root on a system ;-)